Behavior Profiling of Email

Stolfo, Salvatore; Hershkop, Shlomo; Wang, Ke; Nimeskern, Olivier; Hu, Chia-wei

This paper describes the forensic and intelligence analysis capabilities of the Email Mining Toolkit (EMT) under development at the Columbia Intrusion Detection (IDS) Lab. EMT provides the means of loading, parsing and analyzing email logs, including content, in a wide range of formats. Many tools and techniques have been available from the fields of Information Retrieval (IR) and Natural Language Processing (NLP) for analyzing documents of various sorts, including emails. EMT, however, extends these kinds of analyses with an entirely new set of analyses that model "user behavior." EMT thus models the behavior of individual user email accounts, or groups of accounts, including the "social cliques" revealed by a user's email behavior.



More About This Work

Academic Units
Computer Science
Published Here
April 30, 2010


Intelligence and security informatics: first NSF/NIJ symposium, ISI 2003, Tucson, AZ, USA, June 2-3, 2003: proceedings, Lecture Notes in Computer Science, vol. 2665 (New York: Springer, 2003), pp. 74-90.